Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

Researcher Gal Weizman discovered and demonstrated a flaw (ThisBash) in Anthropic’s Claude Dispatch/Cowork functionality that allows a malicious or hijacked browser extension to leverage a logged-in claude.ai session to control Claude Desktop and achieve remote code execution; Anthropic acknowledged the issue as a duplicate, chose not to patch fully, and the design (shared sessions across web/desktop/mobile) enables easy exploitation and lateral movement between devices and accounts.